CVE-2014-1934

NameCVE-2014-1934
Descriptiontag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitylow (attack range: local)
Debian Bugs737062

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
eyed3 (PTS)jessie0.6.18-1vulnerable
stretch0.7.10-1fixed
buster, sid0.8.7-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
eyed3source(unstable)0.6.18-3unimportant737062

Notes

[squeeze] - eyed3 <no-dsa> (Minor issue)
Upstream patch: https://bitbucket.org/nicfit/eyed3/commits/372bbacb7a70
https://bitbucket.org/nicfit/eyed3/issue/65/tagpy-in-eyed3-allows-local-users-to
Neutralised by protected_symlinks kernel temp hardening

Search for package or bug name: Reporting problems